This site runs on one small VPS. On the same box: a static blog, a self-hosted analytics stack, two internal APIs and a password-protected app. One Caddy container terminates TLS for all of them, renews certificates without being asked, and has needed exactly zero manual attention since it was set up.

This post is that setup, config file included, plus the two mistakes we made along the way. If you want the hardware side first, we compared the options in Best VPS for self-hosting in 2026 - everything below runs comfortably on the cheapest tier there.

Why Caddy instead of nginx

nginx is excellent and we still run it as the static file server inside this stack. But for the edge, Caddy wins on one thing that matters at this scale: TLS is not a project . No certbot, no renewal cron, no --dry-run rehearsal at 2 a.m.…